01 / DECISION
When this primitive earns a place
Use Turnstile to add abuse friction to a form or action, while retaining application authentication and authorization.
02 / ARCHITECTURE
Build the smallest defensible path
Render the widget for the correct hostname and action, send the token once, verify server-side, check expected fields, and reject expired or replayed tokens.
- 01Name the contract
Use Turnstile to add abuse friction to a form or action, while retaining application authentication and authorization.
- 02Add one primitive
Render the widget for the correct hostname and action, send the token once, verify server-side, check expected fields, and reject expired or replayed tokens.
- 03Capture failure evidence
Test missing, malformed, expired, duplicate, and wrong-host tokens; confirm the protected action never runs before verification.
03 / REPRODUCE
Evidence before confidence
Test missing, malformed, expired, duplicate, and wrong-host tokens; confirm the protected action never runs before verification.
curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify04 / BOUNDARY
The production boundary
A client-side success callback is not proof. Turnstile does not decide who may perform a privileged action.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.